Reader Question – 9-13-13 – Changing Tiers

I had an interesting question Friday from a Reader who will remain unnamed. He stated that he was a security officer for a CFATS Tier 3 chemical facility and wanted to know what his facility could change to reduce their tier ranking to Tier 4. He didn’t specifically state it, but the intent was almost certainly to lower to cost of their security program.

This a very common business objective. It is difficult to reduce costs on a security program that has to be authorized, approved and inspected by a federal agency. The CFATS program provides only one real way to achieve significant cost savings in a security program and that is to lower the tier ranking of the facility; lower ranked tiers have less stringent risk-based performance standards with which to comply.

Tier Ranking Standards

There is a basic problem in accomplishing this task; ISCD will not discuss the standards they use to perform tier rankings. The closest you’ll get from them is an explanation of how to get removed from the list of high-risk chemical facilities covered under CFATS. That is to remove all DHS chemicals of interest (COI) from the facility or to reduce the inventory levels below the screening threshold quantity (STQ). And actually, it may not be enough for a covered facility to just reduce their inventory below the STQ; more about that in a later post.

DHS has always maintained that the rules that they use to determine CFATS coverage are based upon a complex analysis of risk and that sharing the details of those rules would make it easier for terrorists to select appropriate chemical facility targets. I’m not sure that I totally agree with that, but it is the policy that DHS has fairly firmly stuck with since the inception of the CFATS program.

The GAO and Congress are not really satisfied with the risk assessment process. They would like to see some additional factors added to the risk assessment process, but that will not make it simpler and ISCD is unlikely to share the details of how those factors are implemented if and when that takes place. On a side note; I suspect that, when these factors are included, it will result in expanding the number of facilities covered under the CFATS program and raising some tier rankings of some facilities already covered.

Tell Me What, Not How

My facility security manager reader could care less how ISCD determines their tier rankings. He just wants to know what he has to do to reduce his. He would clearly be satisfied if ISCD were to tell him to A, B and C and we will reduce you to a Tier 4 facility. Unfortunately, the ISCD stance on this is that they are forbidden by Congress from doing this.

Section 550(a) of the Homeland Security Appropriations Act of 2007 (PL 109-295), the Congressional authorization for the CFATS program, states that “the Secretary may not disapprove a site security plan submitted under this section based on the presence or absence of a particular security measure”. Industry has insisted on a strict interpretation of this standard that ISCD may not tell facilities what they must do to secure their facilities. As a consequence ISCD has been very careful (read restrictive) about what they tell facilities in advance about making changes to their program.

A facility may get a Chemical Facility Inspector or the Regional Commander, in a very private conversation, to give them suggestions about what may work in getting a tier ranking lowered, but there is no guarantee that complying with the suggestions will actually result in the actual lowering of the ranking; it is very unlikely that even the regional commanders are fully read into the ranking evaluation process.

Trial and Error

The only sure way to find out how a given facility will be able to lower its tier ranking is through the very inefficient trial and error method. This would entail making changes to the amount inventoried and the storage methods used for the facility’s COIs, submitting the appropriate information to ISCD and waiting for their response.

This is not real helpful for Tier 1 and Tier 2 (and some Tier 3) facilities that have already had their SSP authorized. Most of their security apparatus is already in place so the only capital costs that could be avoided would be those currently budgeted for planned security measures. Even those costs would only be avoided if the ISCD response came back before the monies were actually spent. Operational and maintenance costs could be avoided, however, for some of those security measures at a lower tier ranking.

Tier 3 facilities that are not already well into the authorization process may be able to avoid some significant capital costs by being changed to a Tier 4 ranking and would certainly avoid the operation and maintenance costs of the avoided security measures.

How one goes about submitting this change is the subject for another blog post.

Suggested Changes

DISCLAIMER: I do not know the details of how ISCD ranks tiers. The following discussion is based upon my military physical security experience, years of working in chemical facilities, and a variety of discussions with chemical security professionals over the last six years of writing this blog.

Tier ranking is based upon a risk assessment process. Lowering the risk posed should result in a lowering the tier ranking if enough risk is reduced. Different types of COI present different risks so different types of changes will have to be made depending on the types of chemicals involved.

The ‘easiest’ change to make is to get rid of one or more COI. This could be accomplished by removing the COI from the processes on site, substituting some alternative chemical or eliminating a product line. Frequently this is ‘easy’ only in the eyes of environmental activists, but it is a sure way to reduce on-site risks.

The second easiest change is to reduce the amount of a COI on site. This is particularly true for release security issue chemicals, the lower the amount on hand the lower smaller the area potentially affected by catastrophic release. This is probably not as effective a method of risk reduction for theft/diversion security issue chemicals. The much smaller STQ for these chemicals reflects the fact that it is the risk of these chemicals being converted to improvised weapons (chemical or explosive) that is of concern.

For release threat COI another version of this tactic it to disperse the chemical into multiple smaller containers; typically we are talking storage tanks here. The containers would have to be separated enough that a single attack would not result in the release from multiple containers.

For theft/diversion threat COI the opposite operation can actually reduce risk. Taking these chemicals out of man-portable containers and placing them in storage tanks makes it more difficult to steal the material and easier to secure.

Another possible (though more controversial) method of reducing the risk is to place all of your COI in a relatively restricted area within the overall facility and isolating that area from public view and access. This is particularly useful in a very large facility as it also potentially reduces the portion of the facility that has to be secured to CFATS standards; a significant cost savings.

Remember, circumstances alter the effectiveness of all of the above.

Changes to CFATS

In light of the above discussion, I would like to make a suggestion to lawmakers for consideration when they finally get around to making a permanent (or at least long-term) chemical security program. The language of the legislation should make it clear that DHS has a responsibility to work with high-risk chemical facilities in determining methods of reducing the risk at a facility. This should include making non-binding suggestions as to what security measures could be considered (what has worked at other facilities for instance) as well as what non-security measures facilities can take to reduce their risk rankings.